gooserelayvpn-android-client

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill explicitly requires and connects to public Google Apps Script deployments (see "Obtaining Apps Script Deployment ID" and the debug function testScriptKey which calls https://script.google.com/macros/s/$scriptKey/exec) and also imports profile JSON (including script_keys) from external sources, so untrusted third‑party responses are fetched and used as part of the runtime workflow.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill requires and at runtime calls Google Apps Script endpoints such as https://script.google.com/macros/s//exec (via the profile script_keys) which execute remote server-side code to relay traffic and therefore are a required runtime dependency that can control the agent's behavior.